Skip to content

Update metcalfc/changelog-generator action to v5 - #50

Open
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/metcalfc-changelog-generator-5.x
Open

Update metcalfc/changelog-generator action to v5#50
renovate[bot] wants to merge 1 commit into
masterfrom
renovate/metcalfc-changelog-generator-5.x

Conversation

@renovate

@renovate renovate Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

This PR contains the following updates:

Package Type Update Change
metcalfc/changelog-generator action major v4.6.2v5.0.1

Release Notes

metcalfc/changelog-generator (metcalfc/changelog-generator)

v5.0.1

Compare Source

  • 031a640 - 5.0.1
  • 122a6c2 - Base the changelog on the previous release of the same line, and assert it (#​479)
  • 0bee5ad - fix: return the modified changelog as a real multiline output (#​478)

v5.0.0

Compare Source

Breaking change: commit subjects render as literal text

Every changelog line now wraps the commit subject in an inline-code span.

before:  - [f723555](.../commit/f723555) - build(deps-dev): bump @vercel/ncc to 0.45.0 (#​470)
after:   - [f723555](.../commit/f723555) - ` build(deps-dev): bump @vercel/ncc to 0.45.0 (#​470) `

A commit subject is untrusted input. Anyone whose pull request you merge
chooses that text, and this action pastes it directly into your release notes.
Rendered as active Markdown, a subject could contribute links, images,
@mentions, issue references, raw HTML, or additional changelog entries to a
release it had no business editing. Rendering it as literal text closes that
off.

What this costs you. Subjects render monospace, and #123, GH-123, bare
commit SHAs, and :emoji: inside a subject no longer autolink. Because
GitHub's squash merge appends (#​123) to the subject by default, most lines
in a typical repository lose that link. The generated commit link at the start
of each line is unaffected. Control characters, line and paragraph separators,
and bidirectional-control characters are replaced with spaces, so a subject can
never span more than its own line.

No inputs or outputs changed, and the No Changes. sentinel is unchanged.

Staying on the previous format

v4.9.0
carries every security and dependency fix in this release
-- including undici
7.29.0, which closes 12 advisories -- with the v4 output format untouched. Pin
metcalfc/changelog-generator@v4 to stay there. The v4 tag will keep moving
on the maintenance line.

What is in this release

Relative to v4.9.0, v5.0.0 adds only the escaping change. Both releases share
everything else:

  • Render changelog subjects as literal text (#​475) -- v5 only
  • Keep release tag names out of shell source (#​473)
  • Verify release bundle before attestation (#​474)
  • Bound the dependency overrides and clear the undici advisories (#​476)
  • Stop bump:workflow rewriting pinned actions' provenance comments (#​477)
  • Bump @vercel/ncc (#​470), eslint (#​472), globals (#​471), codeql-action (#​469)

Full history: v4.8.0...v5.0.0

v5

Compare Source

v4.9.1

Compare Source

Patch release for the v4 line

Documentation and CI only. dist/ is byte-identical to
v4.9.0
,
so there is no functional change for consumers; this release exists so the v4
tag points at a commit whose docs are correct.

  • Return the modified changelog as a real multiline output (#​478)

The README's "Simple output modifications" recipe percent-encoded newlines as
%0A, which the long-removed ::set-output command decoded. $GITHUB_OUTPUT
does not, so anyone who copied that snippet got a single line with literal
%0A in it. It now uses the heredoc form, with a random delimiter because the
value is built from commit subjects.

The changelog output format remains unchanged from v4.8.0. See
v5.0.0
for the breaking change that renders commit subjects as literal text.

v4.9.0

Compare Source

Maintenance release for the v4 line

Security and dependency fixes only. The changelog output format is unchanged
from v4.8.0
-- verified byte-identical -- so tracking @v4 is safe.

  • undici 7.29.0, closing all 12 open advisories (4 high)
  • release-workflow hardening: tag names no longer reach a shell as source, and
    the published bundle is now verified against a rebuild before attestation
  • @vercel/ncc 0.45.0 and dev-dependency bumps

v5.0.0
contains these same fixes plus a breaking change: commit subjects render as
literal text, so a merged pull request's subject can no longer inject links or
mentions into your release notes. That change also stops #123 autolinking
inside subjects, which is why it is not on the v4 line.


v4.8.0

Compare Source

Highlights

Failed changelog generation now fails the step

If the changelog could not be generated — an unresolvable ref, any git error — the action printed an ::error:: annotation and then exited 0. The step went green, outputs.changelog was never set, and downstream steps consumed an empty string without anything indicating a problem.

It now exits non-zero.

[!WARNING]
This is a behavior change. A workflow that was quietly passing on a broken changelog will now fail. That is the point — but expect it to surface as new red builds rather than as new errors, since the errors were always being printed.

fetch: true no longer intermittently fails on shallow checkouts

The default fetch path chained two git fetch --depth=1 calls ahead of git fetch --unshallow. Each rewrites .git/shallow while the next has already read it, so git would intermittently abort with:

fatal: shallow file has changed since we read it

Because fetch: true is the default and the exit code was being discarded, this produced a silently empty changelog rather than a visible failure. It was happening in this repository's own CI.

Now a single fetch, requesting --unshallow only when the checkout is actually shallow.

Testing

make test previously ran npm test || echo "no tests available", where npm test was exit 1 — it reported success unconditionally. The project now has a real suite covering changelog.sh against live git fixtures, ref validation, the release scripts, and the built dist/ bundle as the runner executes it. Both fixes above were found by adding it.

Full changelog

  • 98b1282 - 4.8.0
  • 32f61b2 - fix: make the version bump scripts portable (#​466)
  • f64bf35 - build(deps-dev): bump eslint from 10.1.0 to 10.8.1 (#​460)
  • e5f3244 - build(deps-dev): bump brace-expansion from 5.0.5 to 5.0.7 (#​448)
  • 57d0aa3 - build(deps-dev): bump globals from 17.4.0 to 17.9.0 (#​457)
  • ce20209 - build(deps-dev): bump prettier from 3.8.1 to 3.9.6 (#​454)
  • 89d0cce - build(deps): bump actions/attest-build-provenance from 4.1.0 to 4.2.2 (#​464)
  • daae4ab - build(deps): bump the codeql-action group with 3 updates (#​461)
  • 58f7ad5 - fix: fail the step when the changelog cannot be generated (#​465)
  • 4ffdab6 - build(deps-dev): bump @​vercel/ncc from 0.38.4 to 0.44.1 (#​441)
  • ce7d426 - ci: bump codeql-action to v4.37.1 and group its future updates (#​459)
  • cbc6a25 - test: replace the no-op test target with a real suite (#​458)
  • f278f3b - docs: update README example to use actions/checkout v6
  • 3f3af1f - fix: bump actions to Node 24-compatible versions
  • 10c0451 - fix: pin codeql-action to SHA and document supply chain security

v4.7.0

Compare Source

  • 0440d09 - 4.7.0
  • b86feab - fix: drop abandoned replace package, use sed instead
  • 045501a - fix: add build provenance attestation to release workflow
  • 2be9bc1 - feat: upgrade to node24, bump deps, and fix remaining vulnerabilities
  • 250ea21 - fix: override undici to >=6.23.0 to resolve resource exhaustion vulnerability
  • 17d8ad0 - fix: override minimatch to >=3.1.3 to resolve ReDoS vulnerability
  • aab575c - build(deps): bump actions/stale from 10.1.0 to 10.2.0
  • 9e6e620 - Bump @​eslint/js from 9.39.1 to 10.0.1 (#​388)
  • 588e748 - Bump eslint from 9.39.1 to 10.0.0 (#​389)
  • dfc08c5 - Bump isexe from 3.1.1 to 4.0.0 (#​391)
  • 686de53 - Bump globals from 17.0.0 to 17.3.0 (#​386)
  • 364c6d6 - Bump prettier from 3.7.3 to 3.8.1 (#​376)
  • 0ff00c4 - Bump actions/checkout from 6.0.0 to 6.0.2 (#​377)
  • 3e69b75 - Bump @​actions/github from 7.0.0 to 9.0.0 (#​385)
  • 39f8612 - Bump @​actions/exec from 2.0.0 to 3.0.0 (#​384)
  • d347780 - Bump @​actions/core from 2.0.2 to 3.0.0 (#​383)
  • b592e8d - Merge pull request #​367 from metcalfc/dependabot/npm_and_yarn/actions/exec-2.0.0
  • 13741ca - Bump @​actions/exec from 1.1.1 to 2.0.0
  • 0845166 - Merge pull request #​373 from metcalfc/dependabot/npm_and_yarn/actions/core-2.0.2
  • c74c8e7 - Bump @​actions/core from 2.0.1 to 2.0.2
  • 2d92ae4 - Merge pull request #​372 from metcalfc/dependabot/npm_and_yarn/globals-17.0.0
  • a9e4c3f - Bump globals from 16.5.0 to 17.0.0
  • 033e372 - Merge pull request #​374 from metcalfc/dependabot/npm_and_yarn/actions/github-7.0.0
  • b6aca99 - Bump @​actions/github from 6.0.1 to 7.0.0
  • 7ce1518 - Merge pull request #​368 from metcalfc/dependabot/npm_and_yarn/actions/core-2.0.1
  • 89e58fd - Bump @​actions/core from 1.11.1 to 2.0.1
  • e5a31a2 - Merge pull request #​362 from metcalfc/dependabot/npm_and_yarn/prettier-3.7.3
  • 585c493 - Merge pull request #​357 from metcalfc/dependabot/npm_and_yarn/js-yaml-4.1.1
  • 76c95d4 - Merge pull request #​359 from metcalfc/dependabot/github_actions/actions/checkout-6.0.0
  • 5d2cf68 - Bump prettier from 3.6.1 to 3.7.3
  • 17cd2df - Bump actions/checkout from 5.0.0 to 6.0.0
  • 6d41509 - Bump js-yaml from 4.1.0 to 4.1.1
  • 2003f41 - Merge pull request #​355 from metcalfc/dependabot/npm_and_yarn/eslint-9.39.1
  • 40a9ac2 - Bump eslint from 9.39.0 to 9.39.1
  • e4f374d - Merge pull request #​352 from metcalfc/dependabot/npm_and_yarn/globals-16.5.0
  • 191bf39 - Merge pull request #​353 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.39.0
  • 34e79d8 - Merge pull request #​351 from metcalfc/dependabot/npm_and_yarn/eslint-9.39.0
  • 62bd44b - Bump @​eslint/js from 9.38.0 to 9.39.0
  • e522eba - Bump globals from 16.4.0 to 16.5.0
  • a3bac20 - Bump eslint from 9.38.0 to 9.39.0
  • 8cd6286 - Merge pull request #​350 from metcalfc/dependabot/npm_and_yarn/eslint-9.38.0
  • ad21991 - Bump eslint from 9.37.0 to 9.38.0
  • 0afbc99 - Merge pull request #​348 from metcalfc/fix/codeql-permissions
  • 1c146da - fix: add security-events write permission to CodeQL workflow
  • ee94deb - Merge pull request #​347 from metcalfc/fix/codeql-push-trigger
  • 09b9c07 - fix: add push trigger to CodeQL workflow for default branch scanning
  • 5114e96 - Merge pull request #​346 from metcalfc/alert-autofix-9
  • c33398f - Merge pull request #​345 from metcalfc/alert-autofix-7
  • 0d2907a - Potential fix for code scanning alert no. 9: Workflow does not contain permissions
  • 41210ab - Merge pull request #​342 from metcalfc/alert-autofix-6
  • 99e8d80 - Merge pull request #​343 from metcalfc/alert-autofix-5
  • 1a73473 - Merge pull request #​344 from metcalfc/alert-autofix-2
  • b89e945 - Potential fix for code scanning alert no. 2: Workflow does not contain permissions
  • e064bc9 - fix: Permissions for the CodeQL Action.
  • d06c29c - Potential fix for code scanning alert no. 5: Workflow does not contain permissions
  • 21534fd - Potential fix for code scanning alert no. 6: Workflow does not contain permissions
  • 3ba6629 - Merge pull request #​340 from metcalfc/dependabot/npm_and_yarn/eslint-9.37.0
  • cdf755a - Merge pull request #​339 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.37.0
  • 09ec90f - Bump eslint from 9.34.0 to 9.37.0
  • 1873f11 - Bump @​eslint/js from 9.34.0 to 9.37.0
  • 6227b68 - Merge pull request #​334 from metcalfc/dependabot/npm_and_yarn/globals-16.4.0
  • cb41dc8 - Merge pull request #​335 from metcalfc/dependabot/npm_and_yarn/vercel/ncc-0.38.4
  • 3de1395 - Merge pull request #​338 from metcalfc/dependabot/github_actions/actions/stale-10.1.0
  • faba866 - Merge pull request #​341 from metcalfc/dependabot/github_actions/github/codeql-action-4
  • a4da1ae - Bump github/codeql-action from 3 to 4
  • a15082a - Bump actions/stale from 10.0.0 to 10.1.0
  • c780335 - Bump @​vercel/ncc from 0.38.3 to 0.38.4
  • 4e874d3 - Bump globals from 16.3.0 to 16.4.0
  • 14a9ad6 - Merge pull request #​331 from metcalfc/dependabot/github_actions/actions/stale-10.0.0
  • 4451077 - Merge pull request #​330 from metcalfc/dependabot/github_actions/ncipollo/release-action-1.20.0
  • 59f23cd - Merge pull request #​328 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.34.0
  • 4af4b02 - Merge pull request #​327 from metcalfc/dependabot/npm_and_yarn/eslint-9.34.0
  • 3cd0940 - Bump actions/stale from 9.1.0 to 10.0.0
  • 33490a3 - Bump ncipollo/release-action from 1.16.0 to 1.20.0
  • 48dcdf2 - Bump @​eslint/js from 9.33.0 to 9.34.0
  • 02bd226 - Bump eslint from 9.33.0 to 9.34.0
  • e9181f4 - Merge pull request #​326 from metcalfc/dependabot/github_actions/actions/checkout-5.0.0
  • affa499 - Merge pull request #​325 from metcalfc/dependabot/npm_and_yarn/eslint-9.33.0
  • 258c462 - Bump eslint from 9.29.0 to 9.33.0
  • b4db5bf - Merge pull request #​324 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.33.0
  • ca50674 - Bump @​eslint/js from 9.29.0 to 9.33.0
  • 6c72b2e - Merge pull request #​317 from metcalfc/dependabot/npm_and_yarn/globals-16.3.0
  • 8aa7d43 - Bump actions/checkout from 4.2.2 to 5.0.0
  • dd746e6 - Bump globals from 16.2.0 to 16.3.0
  • 179e4c6 - Merge pull request #​312 from metcalfc/dependabot/npm_and_yarn/prettier-3.6.1
  • 5f3246d - Merge pull request #​310 from metcalfc/dependabot/npm_and_yarn/eslint-9.29.0
  • 57be2a5 - Merge pull request #​309 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.29.0
  • 0618660 - Merge pull request #​306 from metcalfc/dependabot/npm_and_yarn/globals-16.2.0
  • 5e28905 - Bump prettier from 3.5.3 to 3.6.1
  • 3a15393 - Bump eslint from 9.25.0 to 9.29.0
  • 9a02e6f - Bump @​eslint/js from 9.25.0 to 9.29.0
  • f6fd2b4 - Bump globals from 16.1.0 to 16.2.0
  • ea5b63f - Merge pull request #​303 from metcalfc/dependabot/npm_and_yarn/undici-5.29.0
  • 9db953a - Bump undici from 5.28.5 to 5.29.0
  • 52ebf7e - Merge pull request #​301 from metcalfc/dependabot/npm_and_yarn/globals-16.1.0
  • e583edc - Merge pull request #​302 from metcalfc/dependabot/npm_and_yarn/actions/github-6.0.1
  • c4e70a6 - Bump @​actions/github from 6.0.0 to 6.0.1
  • 201fdef - Bump globals from 16.0.0 to 16.1.0
  • 74195ce - Merge pull request #​295 from metcalfc/dependabot/npm_and_yarn/eslint-9.25.0
  • af4525a - Bump eslint from 9.24.0 to 9.25.0
  • a85d3e2 - Merge pull request #​294 from metcalfc/dependabot/npm_and_yarn/eslint-9.24.0
  • 7c6abbd - Merge pull request #​293 from metcalfc/dependabot/npm_and_yarn/eslint/js-9.24.0
  • 4f6de05 - Merge pull request #​292 from metcalfc/dependabot/github_actions/metcalfc/changelog-generator-4.6.2
  • ea5463d - Bump eslint from 9.23.0 to 9.24.0
  • 0da0f22 - Bump @​eslint/js from 9.23.0 to 9.24.0
  • 7bfc06a - Bump metcalfc/changelog-generator from 4.5.0 to 4.6.2

Configuration

📅 Schedule: (UTC)

  • Branch creation
    • At any time (no schedule defined)
  • Automerge
    • At any time (no schedule defined)

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 Ignore: Close this PR and you won't be reminded about this update again.


  • If you want to rebase/retry this PR, check this box

This PR was generated by Mend Renovate. View the repository job log.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

0 participants